{
  "family": "uploader",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\n\"Uploader\" is a classification for a specialized class of Trojan or HackTool primarily designed for data exfiltration. Unlike \"Downloaders\" which pull malware onto a system, an Uploader's sole objective is to securely package and transmit sensitive data (such as stolen credentials, proprietary documents, or keylogger logs) from the compromised internal network out to an external server controlled by the attacker.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUploaders are rarely the initial vector of compromise. They are typically dropped and executed by a primary Trojan (like an Info-stealer) or manually deployed by a threat actor who has achieved interactive access via lateral movement or compromised VPN credentials.\n\nOnce executed, the Uploader focuses on stealthy exfiltration:\n<ul>\n<li><strong>Data Staging and Archiving:</strong> The tool locates a staging directory (often created by a companion info-stealer), compresses the stolen data into an archive (like a password-protected `.zip` or `.rar`), and splits it into smaller chunks to avoid triggering data loss prevention (DLP) alerts based on large file transfers.</li>\n<li><strong>Covert Exfiltration:</strong> To bypass perimeter firewalls, Uploaders utilize standard, allowed protocols. They frequently upload the staged data via HTTP POST requests, FTP, or increasingly, by misusing legitimate cloud storage APIs (like Google Drive, Dropbox, or OneDrive) to blend the exfiltration with normal corporate web traffic.</li>\n<li><strong>Self-Deletion:</strong> Once the transfer is successfully acknowledged by the attacker's C2 server, the Uploader will often securely delete the staging archives and its own executable to destroy forensic evidence.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an Uploader in action is a critical, \"break-glass\" incident. It definitively confirms that the network has been breached, sensitive data has been successfully harvested, and the exfiltration phase of the attack is currently underway.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Containment:</strong> The absolute highest priority is to sever the connection to the attacker's server. Implement immediate firewall blocks against the destination IP address or cloud service being utilized for exfiltration.</li>\n<li><strong>Data Loss Assessment:</strong> Security teams must aggressively review proxy logs, firewall traffic, and DNS queries to determine exactly how much data was successfully transmitted before the connection was severed, and identify the contents of the staging directory.</li>\n<li><strong>Global Credential Reset and Hunt:</strong> Assume a severe breach. Force a global password reset for all Active Directory users and initiate a comprehensive threat hunt to identify the initial point of compromise and the tools used to harvest the data.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Uploader",
    "HackTool.Uploader",
    "Exfiltration.Tool"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1041",
    "T1567.002",
    "T1048",
    "T1074.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:23:59Z",
  "type": "Trojan / Exfiltration Tool",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}